Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109668 | medium | 4.3 | No | Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party... | 2026-10-13 |
| CVE-2026-109663 | medium | 6.5 | No | Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some en... | 2026-10-13 |
| CVE-2026-109658 | medium | 6.5 | No | Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enf... | 2026-10-13 |
| CVE-2026-109653 | high | 7.3 | No | Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are render... | 2026-10-13 |
| CVE-2026-109648 | medium | 6.5 | No | Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input valida... | 2026-10-13 |
| CVE-2026-109643 | medium | 6.5 | No | Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints t... | 2026-10-13 |
| CVE-2026-109638 | medium | 6.5 | No | Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input vali... | 2026-10-13 |
| CVE-2026-109633 | high | 8.1 | No | Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted throug... | 2026-10-13 |
| CVE-2026-109628 | medium | 6.5 | No | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-13 |
| CVE-2026-109623 | medium | 5.4 | No | Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-13 |
| CVE-2026-109615 | medium | 6.5 | No | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-13 |
| CVE-2026-109610 | medium | 6.5 | No | Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enfo... | 2026-10-13 |
| CVE-2026-109602 | medium | 5.4 | No | Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuer... | 2026-10-13 |
| CVE-2026-109373 | high | 8.1 | No | ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obta... | 2026-10-13 |
| CVE-2026-109372 | high | 8.7 | No | ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which veri... | 2026-10-13 |
| CVE-2026-109343 | high | 8.1 | No | SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without c... | 2026-10-13 |
| CVE-2026-109338 | medium | 6.5 | No | SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII h... | 2026-10-13 |
| CVE-2026-109334 | high | 8.1 | No | SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level sy... | 2026-10-13 |
| CVE-2026-109333 | medium | 6.5 | No | SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in o... | 2026-10-13 |
| CVE-2026-109324 | medium | 6.5 | No | Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compress... | 2026-10-13 |